Security Controls for Industrial Control Systems EEI/AGA Security Committee Fall Meetings September 13, 2006 Boston, MA Stuart Katzke and Keith Stouffer, National Institute of Standards & Technology, Gaithersburg, MD Marshall Abrams, The MITRE Corporation, Mc Lean, VA David Norton, Entergy, Inc. New Orleans, LA Joe Weiss, KEMA, Inc., Cupertino, CA National Institute of Standards and Technology 1
Presentation Contents • NIST Responsibilities for Industrial Control Systems (ICS) Security • NIST Information Security Program • NIST ICS Security Project – ICSs and Information Systems – Applying Security Controls to ICS – Invitational ICS Workshop – Research Findings – NIST Plans – Contact Information National Institute of Standards and Technology 2
NIST Responsibilities for Industrial Control Systems (ICS) Security • In general – NIST promotes the U.S. economy and public welfare – NIST develops mandatory standards and guidelines for use by federal agencies (except national security systems) – Standards and guidelines may also be voluntarily used by nongovernmental organizations • Specifically concerning ICS – Special Publication (SP) 800-53 Recommended Security Controls for Federal Information Systems requires that federal agencies implement minimum security controls for their organizational information systems • ICS have many unique characteristics differentiating them from traditional information systems National Institute of Standards and Technology 3
NIST ICS Security Project Objectives • Work cooperatively with federal stakeholders and industry to interpret SP 800-53 security controls * for ICSs • Publish SP 800-82 Guide to Supervisory Control and Data Acquisition (SCADA) and Industrial Control System Security initial public draft - September 2006 • Improve the security of public and private sector ICSs – Work with the many on-going industry standards activities • Standards for the ICS industry, if widely implemented, will raise the level of control systems security • Foster convergence – Use open public process in developing candidate set of security requirements * Control has two different uses: (1) An adjective of "system" (e.g., control system, industrial control system) (2) A noun (e.g., security control) National Institute of Standards and Technology 4
NIST Publications Security Standards and Guidelines � Federal Information Processing Standards (FIPS) � Developed by NIST in accordance with FISMA. � Approved by the Secretary of Commerce. � Compulsory and binding for federal agencies; not waiverable. � NIST Guidance (Special Publication 800-Series) � OMB Memorandum M-05-15, FY 2005 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management states that for other than national security programs and systems, agencies must follow NIST guidance. � Other security-related publications � NIST Interagency and Internal Reports and Information Technology Laboratory Bulletins provide technical information about NIST's activities. � Mandatory only when so specified by OMB. National Institute of Standards and Technology 5
Key Standards and Guidelines � FIPS Publication 199 (Security Categorization) � FIPS Publication 200 (Minimum Security Requirements) � NIST Special Publication 800-18 (Security Planning) � NIST Special Publication 800-30 (Risk Management) � NIST Special Publication 800-37 (Certification & Accreditation) � NIST Special Publication 800-53 (Recommended Security Controls) � NIST Special Publication 800-53A (Security Control Assessment) � NIST Special Publication 800-59 (National Security Systems) � NIST Special Publication 800-60 (Security Category Mapping) Many other FIPS and NIST Special Publications provide security standards and guidance supporting the FISMA legislation… National Institute of Standards and Technology 6
Information Security Program Links in the Security Chain: Management, Operational, and Technical Controls � Risk assessment � Access control mechanisms � Security planning � Identification & authentication mechanisms � Security policies and procedures (Biometrics, tokens, passwords) � Contingency planning � Audit mechanisms � Incident response planning � Encryption mechanisms � Security awareness and training � Firewalls and network security mechanisms � Physical security � Intrusion detection systems � Personnel security � Security configuration settings � Certification, accreditation, and � Anti-viral software � Smart cards security assessments Adversaries attack the weakest link…where is yours? National Institute of Standards and Technology 7
The NIST Risk Framework Starting Point FIPS 199 / SP 800-60 SP 800-37 / SP 8800-53A FIPS 200 / SP 800-53 Security Security Control Security Control Categorization Monitoring Selection Define criticality /sensitivity of information system according to Continuously track changes to the information Select minimum (baseline) security controls to potential impact of loss system that may affect security controls and protect the information system; apply tailoring reassess control effectiveness guidance as appropriate SP 800-37 FIPS 200 / SP 800-53 / SP 800-30 System Security Control Authorization Refinement Use risk assessment results to supplement the Determine risk to agency operations, agency assets, or individuals and, if acceptable, tailored security control baseline as needed to ensure adequate security and due diligence authorize information system operation SP 800-53A SP 800-18 SP 800-70 Security Control Security Control Security Control Assessment Documentation Implementation Determine security control effectiveness (i.e., Document in the security plan, the security Implement security controls; apply controls implemented correctly, operating as requirements for the information system and security configuration settings intended, meeting security requirements) the security controls planned or in place National Institute of Standards and Technology 8
ICSs and Information Systems • ICSs are information systems – Historically, little resemblance to typical information systems • Originally, isolated systems running proprietary control protocols • More stringent safety, performance and reliability requirements • Used special purpose operating systems and applications – Today, ICSs resemble corporate information systems • Connected to corporate information systems • Increased connectivity, remote access capabilities, Internet protocols • ICS cyber security implications – Significantly less isolation – More vulnerable to compromise or takeover – Greater need to secure these systems National Institute of Standards and Technology 9
Applying Security Controls to ICS • ICSs have many special characteristics compared to typical information systems – Reliability and availability are key drivers – Different risks and priorities – Significant risk to the health and safety of human lives – Serious damage to the environment – Serious financial risks such as production losses – Negative impact to a nation’s economy • Goals of safety and security sometimes conflict with the operational requirements of ICSs • ICS failures can result in serious disruptions to critical national infrastructures National Institute of Standards and Technology 10
Applying SP 800-53 to ICS • SP 800-53 provides a rich set of security controls – Consistent & complement other security standards – Compliance can demonstrate due diligence • Research/study – Bi-directional mappings & analysis of SP 800-53 ⇔ NERC CIPs • Generally, meeting SP 800-53 meets NERC CIPs • Meeting NERC CIPS does not automatically meet SP 800-53 – U.S. Government (USG) stake holder working group • Get USG stake holder's inputs/experience • Evolve SP 800-53 in cooperation with USG stake holders National Institute of Standards and Technology 11
Invitational USG ICS Workshop • Workshop April 19-20, 2006 at NIST to discuss the development of security requirements and baseline security controls for federally owned/operated industrial/process control systems based on NIST SP 800-53 • Attended by Federal agency stakeholders • Results – Some incorporated SP 800-53, Rev 1 – Continuing work to be reflected in future revisions to SP 800-53 National Institute of Standards and Technology 12
ICS Workshop Activities • Develop draft material for an Appendix and/or Supplemental Guidance material that addresses the application of SP 800-53 to ICS • Review the SP 800-53 controls to – Determine which controls are causing challenges when applied to ICS – Discuss why a specific control is causing a challenge – Develop guidance on the application (or non application) of that control to ICS – Determine if there are any compensating controls that could be applied to address the specific control that can ’ t technically be met National Institute of Standards and Technology 13
Recommend
More recommend
